Blueprints
Evading the exorbitant expenses of endpoints
The cost of Virtual Private Cloud (VPC) endpoints has been eye-popping since its release in 2017. This talk will explain the architectural decisions of endpoints' implementation on a cloud platform while avoiding the wrath of the finance team.
In an enterprise space, especially in regulated organizations, there is an affinity to AWS VPC endpoints. It precludes the requirement of an egress path when connecting to AWS public endpoints because the traffic uses an AWS backbone.
The salient trade-off is a cost that becomes increasingly prominent as more and more AWS accounts are vended. This is a fundamental issue with the flat hourly price dimension that becomes runaway in the absence of oversight.
The way to curtail this cost is to deploy VPC endpoints as a shared service in a centralized hub-spoke model.
The key takeaways of this talk are:
- Architectural design of centralized endpoints
- DNS resolution of endpoints hosted in hub account from spoke accounts
- VPC layout design of hub account and its treatment as a core shared services account
